MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
SHA3-384 hash: b6e8faef5d50045163aba1c98094fdaebf14a802ba58f6410d0387a291a7182a92a516ae47504d0eba530ca4011cc9e5
SHA1 hash: 99d8c98dfe10512411122d7f0c84b70fa86508d5
MD5 hash: 3d2464f216fefa68655ac55172064d74
humanhash: aspen-papa-table-paris
File name:3d2464f216fefa68655ac55172064d74.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'192'960 bytes
First seen:2021-08-16 14:46:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fb0fb8edc31fffe9bb05edbac608d5c5 (5 x RaccoonStealer, 4 x AZORult, 1 x NetWire)
ssdeep 24576:IS72iH9ECoxrUgJPb/EbYVRt93w30lC5IoYvHz:ISbD6UgZBgElC5bYvHz
Threatray 5'909 similar samples on MalwareBazaar
TLSH T185450213F3B4055FF1EA063419287EBB9A29AD395581180BE78ADE0D05E7AC2FDB5703
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://myproskxa.ac.ug/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://myproskxa.ac.ug/index.php https://threatfox.abuse.ch/ioc/190118/

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3d2464f216fefa68655ac55172064d74.exe
Verdict:
Malicious activity
Analysis date:
2021-08-16 14:47:24 UTC
Tags:
trojan rat azorult stealer vidar raccoon
Link:
https://app.any.run/tasks/a4b43c4f-fb13-40b4-b5f0-90e70ad18521

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179567/
Detection(s):
Win.Dropper.Raccoon-9884067-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a process from a recently created file
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c0c0327-5f04-4b98-b762-f6ad9032d9ef
Result
Threat name:
Azorult Raccoon Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833594
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to steal Internet Explorer form passwords
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 466025 Sample: KeAtM1O6Sd.exe Startdate: 16/08/2021 Architecture: WINDOWS Score: 100 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus detection for URL or domain 2->87 89 8 other signatures 2->89 9 KeAtM1O6Sd.exe 16 2->9         started        process3 file4 71 C:\Users\user\AppData\Roaming\Bdsfgsdf.exe, MS-DOS 9->71 dropped 73 C:\Users\user\AppData\Roaming\Acvxgfds.exe, MS-DOS 9->73 dropped 105 Contains functionality to steal Internet Explorer form passwords 9->105 107 Maps a DLL or memory area into another process 9->107 13 Acvxgfds.exe 4 9->13         started        16 KeAtM1O6Sd.exe 83 9->16         started        20 Bdsfgsdf.exe 4 9->20         started        signatures5 process6 dnsIp7 109 Maps a DLL or memory area into another process 13->109 22 Acvxgfds.exe 67 13->22         started        75 185.163.45.248, 49695, 49698, 80 MIVOCLOUDMD Moldova Republic of 16->75 77 telete.in 195.201.225.248, 443, 49694 HETZNER-ASDE Germany 16->77 47 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 16->47 dropped 49 C:\Users\user\AppData\...\vcruntime140.dll, PE32 16->49 dropped 51 C:\Users\user\AppData\...\ucrtbase.dll, PE32 16->51 dropped 53 56 other files (none is malicious) 16->53 dropped 111 Tries to steal Mail credentials (via file access) 16->111 113 Tries to harvest and steal browser information (history, passwords, etc) 16->113 115 Hides threads from debuggers 16->115 27 cmd.exe 16->27         started        29 Bdsfgsdf.exe 188 20->29         started        file8 signatures9 process10 dnsIp11 79 myproskxa.ac.ug 185.215.113.77, 49693, 49696, 49697 WHOLESALECONNECTIONSNL Portugal 22->79 55 C:\Users\user\AppData\...\vcruntime140.dll, PE32 22->55 dropped 57 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 22->57 dropped 59 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 22->59 dropped 67 45 other files (none is malicious) 22->67 dropped 91 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->91 93 Tries to steal Instant Messenger accounts or passwords 22->93 95 Tries to steal Mail credentials (via file access) 22->95 103 2 other signatures 22->103 31 cmd.exe 22->31         started        33 conhost.exe 27->33         started        35 timeout.exe 27->35         started        81 kullasa.ac.ug 29->81 61 C:\ProgramData\vcruntime140.dll, PE32 29->61 dropped 63 C:\ProgramData\sqlite3.dll, PE32 29->63 dropped 65 C:\ProgramData\softokn3.dll, PE32 29->65 dropped 69 4 other files (none is malicious) 29->69 dropped 97 Tries to harvest and steal browser information (history, passwords, etc) 29->97 99 Tries to steal Crypto Currency Wallets 29->99 101 Hides threads from debuggers 29->101 37 cmd.exe 29->37         started        file12 signatures13 process14 process15 39 conhost.exe 31->39         started        41 timeout.exe 31->41         started        43 conhost.exe 37->43         started        45 taskkill.exe 37->45         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 14:46:09 UTC
AV detection:
22 of 46 (47.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=csqnew2ngmqw5eiqzfmi7iywqec67wwsrat6o4wepgbtovcow4ea._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
299c548532e82b62f4b52ad642613b9cecc89c9be39a1da630afbc06cb7cce85
AZORult
29cf2aec62c3504b1914484feff17ae470b51229b1df06f1a30334a08b6db12a
AZORult
69e75e57bc4a09c9a3d7726b28423d10df5b0224177ebfa43930668efd0af5da
AZORult
8b1c960881fc789460b5b274abd43baddb1c92e1a942d3a1080a4adb1f545e50
AZORult
959e3ca2579b6be8a11c06763c5a34ec118abc96d869e25bef06319c92da465e
AZORult
a9b0a14beac57ba149a978c8f0996a4f4e70e003b80c67e631947c9dc3590154
AZORult
d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb
AZORult
d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e
AZORult
+ 5'899 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:oski family:raccoon botnet:c81fb6015c832710f869f6911e1aec18747e0184 discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/210816-ql75s6ab8x/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Azorult
Oski
Raccoon
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M1
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M16
Malware Config
C2 Extraction:
kullasa.ac.ug
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
a567376a7cae7de4da96de4a281c728dcc48f0404cf0488eb21e150439545a36
MD5 hash:
62f96327e33df732ab344b049d5ac542
SHA1 hash:
d89a0b00efed49028821bf26e8a46fc58300bfbc
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
SH256 hash:
2014b3835365b8b190185e0cf87574128b0a98422c4aba3b357535e6e16b145d
MD5 hash:
6d00df89bef4a1d219bf7df5b2e113a6
SHA1 hash:
31120c04ef1f5bc38ecd80f3626256579fcf3251
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
SH256 hash:
c376b3369ff0b7bbaf3f73daa611928e0c202cfa63e1dd67ed8883b1d6bc5220
MD5 hash:
f6bcab0e94d8521f773c6e69194200d2
SHA1 hash:
66cf514339ca51c5efc7c8da44cec9be72b4857c
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
Parent samples :
7045ebc8901b28437b116f9ff37d6e16caf2b47e3b7986cc233add8410f1ec9f
14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9
d0b7a458e09fd14ae8476200bd5acf2fc93ea0e2fea357079a88df80e720c23d
SH256 hash:
8634f5e0d2c4dc398342bcd838726f554d27f5ab93594c68946e5aa5276aeb0a
MD5 hash:
6543120e2f4d8e4f3f1538a6e8bc4efa
SHA1 hash:
fb174d57508b5e3a3941c887273f76faa7e31061
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
SH256 hash:
00fd334bc26bf64cfb8db0f6c3d551f2b55b24ab071d98ac37116bfe4a6b073f
MD5 hash:
73defbf4f7c9eab5f53664b683828041
SHA1 hash:
dcaba7bdc84a3b28daaa4f7c7d976a76b455825a
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
SH256 hash:
14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
MD5 hash:
3d2464f216fefa68655ac55172064d74
SHA1 hash:
99d8c98dfe10512411122d7f0c84b70fa86508d5
Link:
https://www.unpac.me/results/6b9d7965-7e5c-471a-8730-337c544ecf7c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1514315/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/1514297/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
Cape
Cape
https://www.capesandbox.com/analysis/179567/

Comments